CVE-2026-4583

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4583", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-22T08:59:02.251Z", "datePublished": "2026-03-23T10:31:32.192Z", "dateUpdated": "2026-03-25T14:04:39.752Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-23T10:31:32.192Z"}, "title": "Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-294", "lang": "en", "description": "Authentication Bypass by Capture-replay"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "Shenzhen HCC Technology", "product": "MPOS M6 PLUS", "versions": [{"version": "1V.31-N", "status": "affected"}], "modules": ["Bluetooth Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-replay. The attack must originate from the local network. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-22T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-22T10:04:13.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "davimo (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.352420", "name": "VDB-352420 | Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352420", "name": "VDB-352420 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.775434", "name": "Submit #775434 | Shenzhen HCC Technology Co., Ltd M6PLUS MPOS M6PLUS-FW-1V.31-N Missing Anti-Replay Protection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-2-Replay.md", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:04:29.007542Z", "id": "CVE-2026-4583", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:04:39.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4583", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:04:29.007542Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:04:35.368Z"}}], "cna": {"title": "Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay", "credits": [{"lang": "en", "type": "reporter", "value": "davimo (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Shenzhen HCC Technology", "modules": ["Bluetooth Handler"], "product": "MPOS M6 PLUS", "versions": [{"status": "affected", "version": "1V.31-N"}]}], "timeline": [{"lang": "en", "time": "2026-03-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-22T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-22T10:04:13.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352420", "name": "VDB-352420 | Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.352420", "name": "VDB-352420 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.775434", "name": "Submit #775434 | Shenzhen HCC Technology Co., Ltd M6PLUS MPOS M6PLUS-FW-1V.31-N Missing Anti-Replay Protection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-2-Replay.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-replay. The attack must originate from the local network. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-23T10:31:32.192Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4583", "state": "PUBLISHED", "dateUpdated": "2026-03-25T14:04:39.752Z", "dateReserved": "2026-03-22T08:59:02.251Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-23T10:31:32.192Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Bluetooth Handler"], "product": "MPOS M6 PLUS", "vendor": "Shenzhen HCC Technology", "versions": [{"status": "affected", "version": "1V.31-N"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-replay. The attack must originate from the local network. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Afecta a alguna funcionalidad desconocida del componente Gestor de Bluetooth. Realizar una manipulaci\u00f3n resulta en omisi\u00f3n de autenticaci\u00f3n mediante captura-repetici\u00f3n. El ataque debe originarse desde la red local. Se considera que el ataque tiene alta complejidad. Se sabe que la explotaci\u00f3n es dif\u00edcil. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4583", "lastModified": "2026-06-17T10:56:51.863", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4583", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:04:29.007542Z", "version": "2.0.3"}}]}, "published": "2026-03-23T11:16:24.847", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-2-Replay.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.352420"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.352420"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.775434"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-294"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1V.31-N"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MPOS M6 PLUS", "source": "cna", "vendor": "Shenzhen HCC Technology"}, "product": "mpos_m6_plus", "vendor": "shenzhen_hcc_technology"}], "analysis": {"en": {"generated_at": "2026-03-23T11:20:51.697120+00:00", "value": {"mitigation_remediation": ["Check the vendor\u2019s website regularly for firmware or security updates that address this issue.", "Limit network access to the device by placing it behind a secure VLAN or firewall that only trusted users can reach.", "If Bluetooth connectivity is unnecessary, disable the Bluetooth interface to remove the attack surface.", "Enable logging of authentication attempts and review logs for abnormal replay patterns.", "Consider adding physical security controls to reduce the likelihood that an attacker can position a Bluetooth sniffer or replay device near the POS machine."], "summary": {"action": "Assess Impact", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The affected hardware is the Shenzhen HCC Technology MPOS M6 PLUS, specifically firmware version 1V.31\u2011N. No other versions or products are listed as impacted in the current advisory.", "description_and_impact": "A flaw in the Bluetooth handler of the MPOS M6 PLUS 1V.31-N allows an attacker on the same local network to replay captured authentication data and bypass normal authentication. The vulnerability is a classic authentication bypass and replay attack, as classified by CWE-287 and CWE-294. By exploiting this weakness, an unauthorized user may gain unauthenticated access to the device\u2019s services and potentially read or modify sensitive information, in addition to any functional privileges granted to an authenticated user.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low intrinsic severity, and the Exploit Prediction Score is not provided. The issue is not listed in the CISA KEV catalog. The attack requires proximity to the device on the local network, with high exploitation complexity and low likelihood of success. If an attacker can physically route traffic through the Bluetooth interface, they could replay authentication packets, making the risk higher in environments where such devices are exposed to untrusted networks."}}}}, "created": "2026-03-24T10:34:48.003283+00:00", "updated": "2026-03-25T14:49:24.133757+00:00", "vendors": ["shenzhen_hcc_technology", "shenzhen_hcc_technology$PRODUCT$mpos_m6_plus"]}